reverse

Recovering symbols from log functions

Your stripped binary still remembers where it came from

Stripping a binary throws away the symbol table: function names become
sub_140001a30, the directory layout the developer worked in is gone, and you
start your analysis staring at anonymous blobs. Except a stripped binary is
rarely as silent as it looks. If the program uses assert, a custom logger, or
any BUG()-style macro, the compiler has very likely baked its own source
metadata straight into .rodata, and that metadata hands you back names and
structure for free.

This post walks through the trick on a tiny example, then shows two Binary
Ninja plugins that automate it: logrn (recovers names) and arborist
(recovers the source tree).

Read More

malware►reverse

Static Analysis of GLOBAL GROUP Ransomware: From Encrypted Config to Panic Mode

Analysis Date: January 7, 2026
Methodology: Static analysis only
Sample: f6f7a37b49310287a253dbdf81e22f0593f44111215ca9308e46d2c68516196f

TL;DR

In-depth analysis of GLOBAL GROUP ransomware (RaaS), revealing:

  • An encrypted .config section using a custom XOR + LCG algorithm
  • Hybrid encryption: Curve25519 (ECDH) + SHA-512 (KDF) + HC-128 (stream cipher)
  • The “hash” at config offset 0x843 is actually the builder’s Curve25519 public key
  • Three encryption modes based on file size (including a “panic” mode)
  • Per-file ephemeral keys with proper asymmetric cryptography
  • A builder structure allowing per-victim custom configs

Read More

Reversing a StealC Infostealer

TL;DR

Static analysis of a StealC infostealer that uses the Heaven’s Gate technique to transition from 32-bit to 64-bit mode, trying to bypass EDR hooks. Features RC4-encrypted config strings, a custom “MZER” payload marker, and direct syscalls. Successfully extracted the C2 server, decryption key, and 150+ encrypted strings without dynamic execution — full IOCs at the bottom for anyone who just wants the indicators.

Read More

malware

Reversing random stealer

Intro

It had been a while since I last took the time to reverse a real malware sample from scratch.
To avoid getting rusty (and because it’s genuinely fun), I gave myself a simple challenge: grab a completely random malware sample and see how far I could go analyzing it.
Off to MalShare, random click, download a binary without knowing what I was getting into.
Spoiler: it wasn’t a crappy crack — it was a fairly ambitious stealer, with password theft, Discord tokens, encryption, and the usual toolkit.

Read More

fuzzing

AFL - Introduction

This is a simple walkthrough to install, setup and run AFL against an open source dumb C program.

What is AFL

American fuzzy lop is a security-oriented fuzzer that employs a novel type of compile-time instrumentation and genetic algorithms to automatically discover clean, interesting test cases that trigger new internal states in the targeted binary. This substantially improves the functional coverage for the fuzzed code.
– AFL website

Install AFL

Download

First, download the latest AFL source code:

Read More

reverse

Delitcrypt

Intro

This article is about reversing a rust pre-compilation macro that obfuscates strings in the compiled binary.
Another point that will be discussed is the development of a BinaryNinja plugin. I’m writing the article as I go along,
to capture the process as closely as possible, with its changes of direction, disappointments and achievements :)
The purpose of this story is not to provide a turnkey plugin, but rather to explain my reverse engineering methodologies and thoughts,
as well as to progress in the use of the Binary Ninja API. No more spoiler, let’s go!

First attempt

The target

Litcrypt is a Rust proc macro that obfuscates text using a basic XOR method.
Strings are xored at compile time to hide them, and then are “decrypted” at runtime.

Read More